@outerlayer/cli 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @outerlayer/cli
 
+## 0.13.0
+
+### Minor Changes
+
+- 76222d4: The starter `/build` skill no longer parses fixed shapes out of an issue. The agent reads the issue's acceptance criteria in any form and keeps their text as written. `record-criteria.mjs` now takes the agent's file with `--criteria-file`. It keeps the issue's ids when every criterion has one that fits the id grammar, and otherwise numbers them `AC-<item>-NN`. A partly numbered list is now numbered and recorded, not skipped. When an issue has no criteria, the build drafts them from the description and runs the script with `--drafted`, which records the list with `drafted: true`. `outerlayer emit criteria` reads an optional top-level `"drafted": true` from its file and sends it with the list.
+- 07677fd: `outerlayer runner init` creates the runner's API key from your login when the config file has none. It uses the Runner preset, names the key after the machine (`--key-name` to override), creates it on the factory `--app-id` names, and checks it before any VM or service step. On a Mac with `--vm`, the key goes straight into the VM and is never written on the Mac. A login that cannot create keys gets a refusal naming the pasted-key path, which still works as before.
+
+### Patch Changes
+
+- b831165: Fix rough edges a first-time user meets. `init` writes an MCP server entry that runs through npx, so it starts without a global install, and `doctor` warns when the entry's command is not on PATH. `init` marks a connection whose repository still needs linking with `!` and names the factory by its slug. `login` suggests `init` in a repository that is not set up. `doctor` warns when a factory has no connected repository, stops listing one Claude Code install twice, and says the first hook run creates the spool. `work build` names the item and the issue separately, prints the item's page, and honours NO_COLOR and non-terminal output. A runner keeps the build's item key in its own owner-only file instead of `job.json`. The starter build skill uses the branch a host allows, and the code review check says the report's link can take a minute to appear. `runner init`, `runner check` and `runner start` refuse an empty or blank runner key or factory id, or one still holding a `<...>` placeholder, naming the field and the config file.
+- 836d0e0: A validator file can no longer declare `artifact`, `finding` or `findings` as its emit name, the same as `criteria`. Each is an `outerlayer emit` subcommand, so `outerlayer emit <name>` ran the subcommand and the check could never be recorded. A file that declares one now fails to load with a policy error naming the subcommand.
+
+## 0.12.0
+
+### Minor Changes
+
+- c6622d4: Findings join factory-level problems. `outerlayer emit finding` takes `--cause`, `--detail`, `--suggestion`, `--command`, `--error`, `--test` and `--symbol`. When no key matches a known problem, it stores nothing, lists the closest problems and exits with code 3. Run it again with `--problem <id> --link-reason <text>` or `--new`. It prints your recent session events so `--started-at` and `--ended-at` can record the time a problem cost. The finding batch moves to `schemaVersion: 3`; the gateway refuses version 2.
+- d0141dc: `outerlayer runner init --agent claude` leaves a host ready to build. It writes commands that start Claude Code, reads Claude's credential from stdin (a token from `claude setup-token` or an Anthropic API key, told apart by how they start), and stores it in the `runner.env` beside the config with mode 600, keeping every other line. The service starts, or restarts, with the credential loaded. With `--vm`, all of this happens inside the VM. Without `--agent`, `runner init` writes the placeholder commands as before.
+
+### Patch Changes
+
+- c5542d9: `outerlayer init` now ends with "Add an issue on the Work page and choose Build locally, or Build if a host runs for this factory." A new factory has no host, so the line no longer tells everyone to press Build.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -142,9 +142,14 @@ content:
   request it makes with the host key, the way the runner does. The signature
   covers the request's method, path, query and body, and adds nothing else
   to it.
-- **`outerlayer runner init`** makes no network call, except `runner init --vm`
-  on a Mac. That runs `limactl`, and Lima downloads a Linux VM image. Inside
-  the VM, `apt` downloads Node and `npm` downloads this CLI. Your runner key goes to the VM on the standard
+- **`outerlayer runner init`** makes no network call when the config file
+  already holds a runner key. With no key there and a saved login, it
+  creates one: `POST /v1/api-keys` with your login's token, sending the key's
+  name (this machine's name, or `--key-name`), the Runner preset's
+  permissions and the factory id. It then checks the new key, unsigned, with
+  `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
+  and Lima downloads a Linux VM image. Inside the VM, `apt` downloads Node and
+  `npm` downloads this CLI. Your runner key goes to the VM on the standard
   input of a `limactl shell` command and is never a file or an argument on the
   Mac.
 - **`outerlayer login`**, with no key on stdin, signs in to your account by
@@ -297,7 +302,11 @@ content:
 - **`outerlayer emit finding`** and **`outerlayer emit findings <file>`** send
   one finding, or a whole batch of them, for a work item — a problem an agent
   hit in the factory. The anchoring is the same as `emit <name>` (`--item`, or
-  the recorded session's own item).
+  the recorded session's own item). `emit finding` also reads the recording
+  session's local transcript, only to print its recent events (an id, a time
+  and a one-line summary scrubbed of secrets) and to look up the time of the
+  events you name with `--started-at` and `--ended-at`. The transcript itself
+  is never sent; only the two event ids and their times are.
 - **`outerlayer emit criteria <file>`** sends the acceptance criteria of a work
   item as one list (`POST /v1/criteria`): each criterion's id, text and
   declared proof kind, from the JSON file you name. The anchoring is the same
@@ -368,8 +377,8 @@ before it gives up.
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
-| `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding. |
-| `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 2` — the same shape and validation as `emit finding`, one record per id, category, title, file, line, rule and where. Anchored the same way: `--item`, else a recorded session's own item. |
+| `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |
+| `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 3` — the same shape and validation as `emit finding`, one record per id. A finding's `startedAt` and `endedAt` may be event ids. The findings that match a key are stored; those that need a choice are listed with their candidates and not stored, and the exit code is 3. Anchored the same way: `--item`, else a recorded session's own item. |
 | `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |
@@ -382,7 +391,7 @@ before it gives up.
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |
 | `outerlayer work release --item <n>\|--issue <n> [--repo] [--host] [--session-id] [--outcome]` | Marks the lease this API key holds released, optionally recording how the attempt ended. Releasing an already-released lease is a no-op that returns the recorded release time and outcome. Run inside a session with no `--host`, it releases that session's own lease instead (`--session-id` names the session when it cannot be detected), so the item's review opens without ending the session. |
-| `outerlayer runner init [--vm\|--no-vm] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
+| `outerlayer runner init [--vm\|--no-vm] [--app-id <id>] [--key-name <name>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it first creates a runner key from the login with the Runner preset, named after the machine or `--key-name`, on the factory `--app-id` names, and checks it before anything else changes. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |

package/dist/{agent-setup-YEFN74Y4.js → agent-setup-QE6PSCEZ.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-A56PYPDF.js';
-import { installStarterPack } from './chunk-SUMWRA7K.js';
-import { runEmit } from './chunk-YU5GL7QS.js';
+import { runEmit } from './chunk-HDTVTA6I.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-R7OQTKWT.js';
+import { installStarterPack } from './chunk-DXQ5MHCO.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-RWQWPZB4.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-GI4XXD4I.js';
 import './chunk-ZJSNLVCE.js';
-import { pinExists, readContextManifest } from './chunk-BMX3L7CR.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-BGWTYRSS.js';
-import { generatedHeaderSource } from './chunk-TB7EP24C.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-TCIW27FM.js';
+import { pinExists, readContextManifest } from './chunk-LCEXHCHD.js';
+import { generatedHeaderSource } from './chunk-2M63GG56.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-PLMTLGYH.js';
-import './chunk-YT35WGIP.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-RA3O54FC.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-07T20:56:19.457Z+b4e50a8","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-08T17:26:49.421Z+36ec792","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-PP436VGZ.js → builder-UUS4ORDH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-CJGQQZWB.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-NX57IBNK.js';
 import './chunk-CX22S5BA.js';
-import './chunk-IU4NZROR.js';
+import './chunk-JXYVA45C.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
-import './chunk-YT35WGIP.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-YDXOLVJ5.js → check-63IDCEEV.js}

@@ -1,68 +1,69 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-3YFCWYBU.js';
+import { probeCredentials } from './chunk-SVEP7PVH.js';
+import './chunk-C6IV5BV7.js';
+import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
-import './chunk-BHOBM3IZ.js';
-import './chunk-T6OIJQRT.js';
+import './chunk-RMWLBUCJ.js';
+import './chunk-I2UOAV7X.js';
 import './chunk-FI5UYJMQ.js';
-import './chunk-O765JR4W.js';
-import './chunk-HKUH5AR2.js';
-import './chunk-HYZRY4KZ.js';
-import './chunk-Y6P5XX2B.js';
+import './chunk-XJKL4BNU.js';
+import './chunk-3D4OYFCD.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-R7BJYFD2.js';
-import './chunk-TI7B7UEO.js';
+import './chunk-HYZRY4KZ.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-TOPDNXHZ.js';
 import './chunk-YYYRBYWG.js';
+import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-7C4T5BGN.js';
-import './chunk-BEZSECPA.js';
-import './chunk-E5DC4VZL.js';
+import './chunk-MJXXRX4M.js';
+import './chunk-P6FX4D43.js';
+import './chunk-MZN7AQOB.js';
+import './chunk-T5VPP6H7.js';
+import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-JKIWMRFH.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-2GBCTEN4.js';
+import './chunk-3KTA5UU2.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-CJGQQZWB.js';
+import './chunk-NX57IBNK.js';
 import './chunk-CX22S5BA.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-DTDZXDQ3.js';
-import './chunk-ZQ5JGHUO.js';
-import './chunk-BFESLKPP.js';
-import './chunk-UES67HLJ.js';
-import './chunk-VDI5POCC.js';
-import './chunk-IU4NZROR.js';
-import './chunk-USO2DKBD.js';
+import './chunk-P4MM66C6.js';
+import './chunk-EFZLAYPE.js';
+import './chunk-IP7BIBXJ.js';
+import './chunk-4QVZCVWT.js';
+import './chunk-CNFVHDHG.js';
+import './chunk-JXYVA45C.js';
+import './chunk-4KSQKQXE.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XR3BJN33.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-RWQWPZB4.js';
+import './chunk-GI4XXD4I.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-BMX3L7CR.js';
-import './chunk-BGWTYRSS.js';
-import './chunk-TB7EP24C.js';
+import './chunk-TCIW27FM.js';
+import './chunk-LCEXHCHD.js';
+import './chunk-2M63GG56.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-PLMTLGYH.js';
-import './chunk-YT35WGIP.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-4HMXH2OA.js';
+import './chunk-SFFHGX3G.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-XR3BJN33.js → chunk-22RMZBGW.js}

@@ -47,6 +47,23 @@ function defaultRunnerConfigPath(home = homeFromEnv()) {
 function fail(configPath, key, reason) {
   throw new RunnerConfigError(`${configPath}: ${key} ${reason}`);
 }
+var PLACEHOLDER = /[<>]/;
+function runnerCredentialProblem(config) {
+  for (const field of ["url", "apiKey", "appId"]) {
+    const value = config[field];
+    if (value === void 0) return { field, reason: "is missing" };
+    if (typeof value !== "string") return { field, reason: "is not text" };
+    if (value.trim() === "") return { field, reason: "is empty" };
+  }
+  if (PLACEHOLDER.test(config.apiKey)) {
+    return { field: "apiKey", reason: "is still a <...> placeholder. Put the factory's runner key there: an API key made with the Runner preset" };
+  }
+  const appId = config.appId;
+  if (PLACEHOLDER.test(appId)) {
+    return { field: "appId", reason: `is still the placeholder ${JSON.stringify(appId)}. Put the Factory Id from the factory's Settings \u2192 General there` };
+  }
+  return void 0;
+}
 function readConfigFile(configPath) {
   if (!existsSync(configPath)) return {};
   const text = readFileSync(configPath, "utf8");
@@ -171,6 +188,8 @@ function loadRunnerConfig(configPath) {
   if (!config.url || !config.apiKey || !config.appId) {
     fail(configPath, "url/apiKey/appId", "missing \u2014 pipe a factory key into `outerlayer login` for this config file first; a runner uses a factory key, never a person's login");
   }
+  const credentialProblem = runnerCredentialProblem(config);
+  if (credentialProblem !== void 0) fail(configPath, credentialProblem.field, credentialProblem.reason);
   const runner = config.runner;
   if (!runner) {
     fail(configPath, "runner", "block is missing");
@@ -379,4 +398,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-TB7EP24C.js → chunk-2M63GG56.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-YT35WGIP.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-J5M7BSJQ.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-Y6P5XX2B.js → chunk-3D4OYFCD.js}

@@ -4,17 +4,17 @@ import { LaunchFilter } from './chunk-HHJDN6AU.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-VDI5POCC.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-IU4NZROR.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-CNFVHDHG.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YT35WGIP.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-J5M7BSJQ.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-4HMXH2OA.js';
+import { writeSyncStatus, spoolDir } from './chunk-SFFHGX3G.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-2GBCTEN4.js → chunk-3KTA5UU2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-CJGQQZWB.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-NX57IBNK.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-USO2DKBD.js → chunk-4KSQKQXE.js}

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import { revokeTokenOnDashboard } from './chunk-N6LURUEF.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -269,14 +270,19 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
   }
   deps.stdout.write(
     `${C.green}\u2713${C.reset} Logged in as ${approved.email}. Saved the login to ${path}
-Next: run \`outerlayer connect\` to choose a factory.
-`
+` + nextAfterLogin(deps.cwd ?? process.cwd())
   );
   if (before.apiKey) {
     deps.stdout.write("A factory key is also saved on this machine, so commands here keep using the key, not this login.\n");
   }
   return 0;
 }
+function nextAfterLogin(cwd) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return "Next: in your repository, run `outerlayer init --factory <org>/<factory>`.\n";
+  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return "Next: run `outerlayer connect` to choose a factory.\n";
+  return "Next: run `outerlayer init --factory <org>/<factory>` to set up this repository.\n";
+}
 function fail(deps, message) {
   deps.stderr.write(`${C.red}\u2717${C.reset} ${message}
 `);

package/dist/{chunk-UES67HLJ.js → chunk-4QVZCVWT.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-VDI5POCC.js';
-import { remoteLookupFailed } from './chunk-IU4NZROR.js';
-import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { remoteLookupFailed } from './chunk-JXYVA45C.js';
+import { DEFAULT_DASHBOARD } from './chunk-4KSQKQXE.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
@@ -181,7 +181,7 @@ function saveFactoryConnection(gitCommonDir, saved, factory, now) {
   });
 }
 function connectedLine(repository, factory, reason) {
-  return `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
+  return `Connected ${repository} to factory "${factory.displayName}" (${slug(factory)}) in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
 }
 function autoConnectedLine(repository, factory, reason) {
   return `Using factory "${factory.displayName}" in ${factory.organization.displayName} for ${repository} (${REASON_TEXT[reason]}); saved for this checkout.`;
@@ -310,4 +310,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };
+export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, workPageUrl };

package/dist/{chunk-I263FZ3A.js → chunk-6S3H3J6H.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-ZQ5JGHUO.js';
-import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity } from './chunk-IU4NZROR.js';
+import { autoConnect } from './chunk-EFZLAYPE.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';

package/dist/{chunk-BHOBM3IZ.js → chunk-C6IV5BV7.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-HKUH5AR2.js';
+import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
+import { senderPidfile } from './chunk-XJKL4BNU.js';
+import { installScrubContext } from './chunk-3D4OYFCD.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { installScrubContext } from './chunk-Y6P5XX2B.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-E5DC4VZL.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-MZN7AQOB.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-3FMPZPJQ.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-2GBCTEN4.js';
+import { childEnvironment } from './chunk-3KTA5UU2.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DTDZXDQ3.js';
-import { planArtifactUpload } from './chunk-VDI5POCC.js';
-import { scrubText } from './chunk-IU4NZROR.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-XR3BJN33.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-P4MM66C6.js';
+import { planArtifactUpload } from './chunk-CNFVHDHG.js';
+import { scrubText } from './chunk-JXYVA45C.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4Q7OMKAT.js';
-import { parsePolicy } from './chunk-TB7EP24C.js';
+import { parsePolicy } from './chunk-2M63GG56.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-VDI5POCC.js → chunk-CNFVHDHG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-YT35WGIP.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-J5M7BSJQ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';